bearmtnmartin
bearmtnmartin SuperDork
9/9/19 11:29 a.m.

My business website keeps getting these odd spam emails to the contact page. I am adding a two stage verification so a machine can no longer generate them, but I am curious as to what the point of them is. 

They are limited to just what you see here: A random name email and phone, and the company is Google. The first three lines are always different info but the bottom line is always google. There is never an attachment or any message body. So they are just an irritant, but I am wondering what the point is. 

 

Cooter
Cooter UltraDork
9/9/19 11:32 a.m.

Following, as spammers and scammers and their how and why have always fascinated me.

(not) WilD (Matt)
(not) WilD (Matt) Dork
9/9/19 11:42 a.m.

My guess is that the email address isn't one, but rather a clickable hyperlink that will direct to a melicious website or otherwise initiate an malware install if it is clicked out of curiosity or inatentiveness. 

GameboyRMH
GameboyRMH MegaDork
9/9/19 1:46 p.m.
bearmtnmartin said:

The first three lines are always different info but the bottom line is always google.

There's the key to getting rid of them. I used to get similar entries on my company's website, which has a contact form that only allows plaintext, it was usually SEO spam, and the company name would always be "google" so my idea was that if anyone from the company "google" (case-sensitive) sent us a message, I'd have the contact form run a little delay loop to look like it was doing something, silently dump the message and report success. No more spam problems, and I avoided the trouble of a CAPTCHA test!

MadScientistMatt
MadScientistMatt PowerDork
9/9/19 2:03 p.m.

Some CAPTCHAs are set up to automatically let Google accounts through - I wonder if that's partially what is going on here.

I'm guessing the attack may have had some other intended payload, which doesn't make it through the contacts form.

Ransom
Ransom UltimaDork
9/9/19 2:42 p.m.

I think the "malicious link" or missing payload ideas are good.

The only other thing I came up with is some attempt at getting you to do something with a compromised email. Either the idea that some folks might click it and thereby make it a semi-verified address to their mail client (i.e. less likely to be junk-foldered when subsequent spam is sent from that address), or just that any email sent to that address gives them in turn a valid email address to spam.

Or maybe it's the first step of a phishing attempt; start with a contact form, gain a response from a valid internal business email, phish away...

So much of the spam/phishing thing is the viability of something that's got a 0.001% success rate. If you submit 10,000 of them you get 10 responses, and that's 10 responses who were willing to query a random email because they're curious about what "google" wanted to email about and inattentive enough not to notice/care that "google" is emailing them with an op.pl email address... Morever, a contact form isn't just another thing in your inbox, it's in many cases a lead, and that can motivate people to write back...

bearmtnmartin
bearmtnmartin SuperDork
9/9/19 2:50 p.m.

I think there is a good chance that there is a machine generated link that my site filters out. So all I get to my email is the harmless bit. 

I am fine with captcha because the only emails I want from my site are people who are prepared to spend the time on a conversation with me. I do not sell from it so I don't need to generate lots of hits. Mostly it's people who have seen or heard of my product and are looking for specs.

You'll need to log in to post.

Our Preferred Partners
tVqzs66KR8NcjL4MjhcjvWEKAZw47fXaVvo8LR0YgBOTaZvkhbDkUI303QnUmpgC